authenticate user, and generate access token